A hacking incident at the Ministry of SMEs and Startups' "Modu's Startup" program, which leaked the personal information and startup ideas of thousands of selected participants, was caused not by an external attack but by hacking from a company that took part in the project.
According to a "Personal Information Leak Report" submitted to Rep. Kang Seung-kyu of the People Power Party by the Korea Institute of Startup and Entrepreneurship Development (KISED) under the Ministry of SMEs and Startups on Tuesday, an artificial intelligence (AI) solutions firm participating in the project obtained private email addresses through abnormal application programming interface (API) calls. The firm was found to have sent promotional emails to the email addresses it had obtained.
Email addresses set to private are not displayed on external screens, but KISED determined that the firm had acquired them through specific API calls as well as "web crawling," an AI-based automatic data collection function. The leaked items included privately processed emails, evaluation comments, and idea summaries. However, KISED said the exact scale of the leak still needs to be determined. The firm had been tasked with supporting various AI uses so that participants could develop their startup ideas in concrete terms.
"While the functions were blocked so that the relevant information could not be accessed on the service screen, the security of some server APIs, such as challenger profiles and evaluation comments, was inadequate," KISED said. "As a measure to minimize the damage from the leak, we will set up a function on the homepage so that data subjects can check whether their personal information has been leaked, and we will establish and provide guidance on a dedicated channel for receiving damage reports to minimize further harm."
"It appears that this personal information leak occurred from a company included among the Modu's Startup AI solutions firms," Rep. Kang said. "Rather than forcibly pushing ahead with a project that did not even exist at the time of the National Assembly's budget review, the Ministry of SMEs and Startups must conduct a full re-examination of its lax project management system."
